For many Kenyans, the December holidays remain the one time of year when wallets open wide, tables full of food, and families undertake the annual pilgrimage from city to village. Nairobi, Mombasa and Kisumu empty out. Shopping malls fill, mobile money transactions spike, and roads leading upcountry become rivers of matatus, private cars and overloaded buses.
Yet beneath the familiar seasonal bustle lies a less cheerful constant: fraudsters know exactly when Kenyans are most distracted, most generous and most likely to let their guard down.
According to data observed by Absa Bank Kenya, cases of digital fraud climb sharply every December, often far exceeding year-round averages. A recent Kaspersky Africa report puts the broader trend in stark numbers, a 438 percent increase in fraud incidents in Kenya with the rate of fraud expected to rise typically during Christmas break where clients rely on mobile banking.
The two most prevalent schemes right now are variations on what the industry calls Authorized Push Payment (APP) fraud and classic phishing.
In APP scams, fraudsters engineer situations that prompt victims to voluntarily send money. A common script involves an urgent message claiming to be from a relative or close friend in distress (“I sent you money by mistake, please send it back quickly”). Another plays on payday timing, with criminals posing as legitimate contacts asking for “help” that quickly escalates into substantial transfers. Because the victim authorizes the transaction, recovery is almost impossible.
Phishing attacks, meanwhile, have grown more sophisticated. Messages masquerading as bank alerts, delivery notifications or competition winnings arrive with urgent calls to action: click a link, enter your PIN, verify your account. One tap often hands criminal the keys to mobile banking apps or M-Pesa wallets.
Banking officials describe the phenomenon as textbook social engineering, the exploitation of human psychology rather than technical vulnerabilities. Criminals lean on trust, urgency, greed and seasonal goodwill, all of which are in abundant supply in December.
“We’ve seen a clear seasonal pattern,” said an Absa Bank Kenya spokesperson. “People are sending large amounts to multiple family members, often in a hurry, and they’re more likely to respond to anything that appears urgent or emotional.”
In response, the industry has leaned heavily into public education. Absa and other banks now routinely send fraud alerts, publish warnings on social media and in newspapers, and maintain dedicated fraud hotlines. Absa says it has also expanded its customer education program, aiming to equip account holders with practical tools to recognize and interrupt attacks in progress.
The Kenya Bankers Association’s long-running Kaa Chonjo (“Be Alert”) campaign, now in its 15th year, continues to promote basic digital hygiene: never share PINs, verify unexpected requests through known telephone numbers, and treat any unsolicited link with suspicion.
Despite these efforts, the numbers suggest the public still has some distance to travel. Regulators and commercial banks have introduced chip-and-PIN cards, transaction limits on mobile platforms, biometric authentication and real-time suspicious-activity monitoring, but the human factor remains the weakest link.
Security experts offer a short, blunt holiday checklist:
- Never click links in unsolicited messages, whether by SMS, WhatsApp or email.
- Double-check payment details — especially when someone asks you to “reverse” or “correct” a mobile money transfer.
- Never share your PIN, password or one-time verification code — not even with someone claiming to be from your bank.
- Check account balances frequently during the season and report anomalies immediately.
As Kenyans pack for the journey home and prepare to celebrate, the message from the banking sector is sober: the same spirit of generosity that defines the season is what criminals count on to do their work. This year, vigilance may be the most important gift of all.
